The New York State Department of Financial Services issued an industry letter on Oct 22 about CVE-2026-109618 and CVE-2026-109619. It tells regulated entities to find every PHP use (including internet-facing apps and third-party providers), patch immediately with internet-facing systems first, take systems that can't be patched offline until secured, and review logs for PHP processes launching shells, running commands or downloading tools. DFS says a WAF may give limited protection but is not a substitute for patching or isolation, and ties each step to its 2026 Heightened Cybersecurity Threat Environment Guidance.